How to Use Laptop As Datalogger

Using a laptop to log activity permits the administrator to test discrete networks.

Mobility is the primary advantage of a laptop. There are two ways a laptop can be used for data logging -- as a wireless sniffer collecting data about wireless network traffic, or as an actual log server collecting logs from servers and network devices. System administrators can search for rogue wireless access points or use the laptop as a platform for a logging application.

Things You'll Need

• Laptop
• Wireless network card
• Ethernet card

Instructions

1. Prepare the hardware. Install the wireless network or Ethernet card. Many laptops come with built-in wireless interfaces, but if necessary, add a PCMCIA wireless card with 802.11n support. An extended antenna may be necessary if troubleshooting a wireless network. There are several wireless range extenders. The laptop itself requires 80GB of storage or more, 4GB or more of RAM and 2GHz processor or faster.

2. Select the logging application. Depending on the use, there are many software choices for a laptop. Air Magnet, for example, is a commercial product designed to gather data about a wireless network and its traffic. This allows the system administrator to troubleshoot wireless network problems and locate security threats. When the laptop is used as a log server, tools like Log Logic or Tripwire Log Center provide the ability to collect and correlate log data.

3. Install the logging software. Any application chosen has its own installation routine. Tripwire Log Center, for example, requires that a MySQL database is installed first. The Tripwire Log Center Manager connects to the database to store logged events. The Tripwire Log Center Console is installed to configure the database and rules to parse the collected logs.

4. A tremendous amount of data is collected when there are a lot of devices. Be prepared to let the laptop sit and collect data for a few days to a week. This allows the logging application to collect a large enough sample to detect patterns and trends in traffic and activity. Trend and correlation reports show administrators anomalous network activity that permit them to troubleshoot problems. The Tripwire Log Center Console provides a number of report templates and search functions to display events of interest.

References

• AirMagnet: AirMagnet WiFi Analyzer
• LogLogic: All-in-One Solutions
• Tripwire: Tripwire Log Center